FUSIONFALL REDEMPTION - WINDOWS SERVER
==================================

Release: 2026.08.27 Reborn r23 original crate rates

Public login endpoint: 207.246.94.160:7777
Public shard endpoint: 207.246.94.160:7778
Computress monitor endpoint: 207.246.94.160:8003

INSTALL
1. Extract this entire folder on the Windows Vultr server.
2. In Vultr Firewall, allow inbound TCP 7777 and TCP 7778. Allow TCP 8003
   from the bot host's public IP only.
3. Run Configure-WindowsFirewall.ps1 as Administrator with the bot source IP:
   .\Configure-WindowsFirewall.ps1 -BotSourceAddress '<BOT_SOURCE_IP>'
4. Run Verify-ServerPackage.ps1.
5. Double-click Run-RebornServer.cmd.

AZURE DROP VERIFICATION
Before deployment, run:
  winfusion-reborn.exe --audit-azure-drops
The process loads the effective packaged base-plus-patch data, exercises the
same rarity and item selection functions used by crate openings, prints the
Mask/Wings hit counts—including separate chest-1 and chest-2 samples—and exits
without opening the database or listeners.
Normal startup runs the same contract and refuses to start if it fails.
The audit is read-only: this release has no Reborn drop-weight overlay and does
not change item-set weights at runtime.

NANO LOGIN VERIFICATION
Before deployment, run:
  winfusion-reborn.exe --audit-nano-login
The executable must visibly start Practice Pranks task 461 for the simulated
level-2, Buttercup-only, 25-FM character and then pass every progression tier.
An audit that prints no Nano task-start lines is not a valid pass.

The executable is self-contained. No Visual C++ redistributable, Python,
Node.js, Java, or separate SQLite installation is required.

The first start creates database.db. That file contains player accounts and
progress. Back it up before every update. It is intentionally not included in
this release package, so local test users and passwords are not published.

PUBLIC-SERVER SAFETY
- New accounts receive normal player permissions (accountlevel=1).
- Login packet payloads are never written by the structured tracer.
- Packet tracing is disabled in config.ini for normal operation.
- config-diagnostics.ini enables detailed tracing temporarily.
- OpenFusion's legacy password protocol is not TLS encrypted. Do not encourage
  players to reuse passwords from another service.
- The monitor protocol is plaintext and unauthenticated. Never expose TCP 8003
  to 0.0.0.0/0; use the Vultr and Windows source-IP allowlists.

PORT NOTE
OpenFusion uses separate login and shard listeners. Players connect initially
to 207.246.94.160:7777; the login server then hands the client the gameplay
endpoint 207.246.94.160:7778. Both ports must be reachable.

COMPUTRESS NOTE
The Discord bot connects separately to 207.246.94.160:8003. This is not a game
client port and should be reachable only from the machine running the bot.
